Controllerless Networks

Hi

 

I'm seeing clients showing up with 0.0.0.0 as an IP address. Can anyone shed light as to what these are, and if I should be concerned?

 

Client IPs are issued by a Windows 2012 R2 server.

 

305 AP's running 6.5.1.5-4.3.1.6_61735

 

Cheers

What authentication are you using on that SSID?

 

WPA2 personal + MAC auth via local.

Has this ever worked?  Do any devices on that SSID get ip addresses or this is a new SSID?

Yep, it works well, and we have approx 18 concurrent clients on there. It's
a BYOD service for staff phones to access the Internet.

It is possible those are devices that have the PSK, but are not in the mac address table?

It's possible. Would that produce this effect? It's Fri night here, so I won't be able to test or check MACs until Tuesday (Stat holiday on Monday, too).

I have a similar situation.  I have just deployed iap 315s. I am using Mac Authentication and WPA2.  There are about 4 clients showing in the gui that are not whitelist mac addresses and have 0.0.0.0 as IP addresses.  I have since blacklisted them and they still show up as a client.  I checked the cli and they are shown as permanent blacklist.  How do you think these clients are showing as clients?

I finally had enough time to do some testing. This is caused by clients knowing the PSK but not being on the allowed MAC list.

 

Thanks to everyone for the suggestions :)

Hello, 

I have same exact issue too but  in my authentication I don't use Mac Address list. 

 

I have 2 different SSID, first one is limited to internal network, it's just providing internet connection to guests users with WPA-PSK2 method. (there is no issue with that) second one is unlimited access and it provides internal network access too with enterprise level WPA-PSK2 method, which authenticates users via their certificates and username and passwords from Radius server. 

 

I don't know why but my users can not join to enterprise level network sometime. interesting thing is, even if they are authenticated, they can not obtain an IP address from DHCP server. (on this SSID, as I mentioned there is no limitation to access DHCP or something else) when they tried it, I saw their devices with the 0.0.0.0 IP address. 

Any suggestion?

---

@milamberwrote:

Hello, 

I have same exact issue too but  in my authentication I don't use Mac Address list. 

 

I have 2 different SSID, first one is limited to internal network, it's just providing internet connection to guests users with WPA-PSK2 method. (there is no issue with that) second one is unlimited access and it provides internal network access too with enterprise level WPA-PSK2 method, which authenticates users via their certificates and username and passwords from Radius server. 

 

I don't know why but my users can not join to enterprise level network sometime. interesting thing is, even if they are authenticated, they can not obtain an IP address from DHCP server. (on this SSID, as I mentioned there is no limitation to access DHCP or something else) when they tried it, I saw their devices with the 0.0.0.0 IP address. 

Any suggestion?

---

 

As you mentioned, this is not likely the same issue since mac authentication is not being used.

 

For your internal users that are using certificates along with username and password to authenticate, that is not using WPA2-PSK but rather WPA2-Enterprise. If it is only some users who can not connect to the internal network, start with the RADIUS server and to see if users are being authorized correctly. 

Well thanks for your quick reply. however it's not for same users, time to time it happens to all users. 

 

at first it happens with only one of APs. I reset it to factory defaults and it took configs from others, looks like it fixed but after a while it happened again, now I'm not sure why it's happening however, when I connect one of those users, Mac book says it's authenticated, however couldn't obtain IP address and obtain APIPA IP (169.0.0.0 block)...

I'm realy confused I checked warnings on APs and couldn't see any issue with Radius. 

 

Any suggestion?

I would start with logs on the radius server and work back from there. Basically looking to verify positive authentication for the problem user, and the response time taking to get that positive response back to the authenticator.

 

From there, move to the dhcp server, and verify that it's receiving dhcp requests from the clients, and responding with offers. The response time on the dhcp server is also important.

 

If you see problems in either place (radius or dhcp servers), the information learned about the problem will help pinpoint where to look next. If this issue is critical, I would recommend opening a support ticket with TAC for quicker assistance.

We have found this happens alot, BUT it is do to the fact that our lease of inactivity was set to 6 hours. and for these devices that get a 0,0.0.0 IP , it usually means that the device moved out of range of the AP to get a properIP from the DHCP server.

 

these tend to stay on on VC until the 6 hours is up and then they are gone...